source: trunk/include/sh_unix.h@ 580

Last change on this file since 580 was 580, checked in by katerina, 11 months ago

Fix for ticket #468 (file attributes). Also add option to switch off check.

File size: 11.4 KB
Line 
1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 1999 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20
21
22#ifndef SH_UNIX_H
23#define SH_UNIX_H
24
25/* For PATH_MAX */
26#include <limits.h>
27#if !defined(PATH_MAX)
28#define PATH_MAX 1024
29#endif
30
31#include <unistd.h>
32#include "samhain.h"
33#include "sh_error.h"
34
35
36typedef enum {
37 SH_ISLOG,
38 SH_ISFILE,
39 SH_ISDIR,
40 SH_ISDATA
41} ShOpenType;
42
43typedef enum {
44 SH_DATA_RAW,
45 SH_DATA_LINE
46} ShDataType;
47
48typedef enum {
49 SH_FILE_REGULAR,
50 SH_FILE_SYMLINK,
51 SH_FILE_DIRECTORY,
52 SH_FILE_CDEV,
53 SH_FILE_BDEV,
54 SH_FILE_FIFO,
55 SH_FILE_SOCKET,
56 SH_FILE_DOOR,
57 SH_FILE_PORT,
58 SH_FILE_UNKNOWN
59} ShFileType;
60
61/* -- Attributes to check. --
62 */
63
64/* checksum */
65#define MODI_CHK (1 << 0)
66/* link */
67#define MODI_LNK (1 << 1)
68/* inode */
69#define MODI_INO (1 << 2)
70
71/* user */
72#define MODI_USR (1 << 3)
73/* group */
74#define MODI_GRP (1 << 4)
75/* mtime */
76#define MODI_MTM (1 << 5)
77
78/* ctime */
79#define MODI_CTM (1 << 6)
80/* atime */
81#define MODI_ATM (1 << 7)
82/* size */
83#define MODI_SIZ (1 << 8)
84
85/* file mode */
86#define MODI_MOD (1 << 9)
87/* hardlinks */
88#define MODI_HLN (1 << 10)
89/* device type */
90#define MODI_RDEV (1 << 11)
91
92/* size may grow */
93#define MODI_SGROW (1 << 12)
94/* use prelink */
95#define MODI_PREL (1 << 13)
96/* get content */
97#define MODI_TXT ((1 << 14)|MODI_CHK)
98#define MODI_TXT_ENABLED(a) (((a)&(1 << 14))!=0)
99
100/* get audit record */
101#define MODI_AUDIT (1 << 15)
102#define MODI_AUDIT_ENABLED(a) (((a)&(1 << 15))!=0)
103/* do not check */
104#define MODI_NOCHECK (1 << 16)
105/* do not check */
106#define MODI_ALLIGNORE (1 << 17)
107
108#define MODI_TIGER192 0x01000000UL
109#define MODI_SHA1 0x02000000UL
110#define MODI_MD5 0x03000000UL
111#define MODI_SHA256 0x04000000UL
112#define MODI_HASHTYPE 0x0F000000UL
113
114#define MODI_INIT 0xD0000000UL
115#define MODI_INITIALIZED(a) (((a) & 0xF0000000UL) == MODI_INIT)
116
117#define MODI_SET(a, b) ((a) |= (b))
118#define MODI_CLEAR(a, b) ((a) &= ~(b))
119#define MODI_ISSET(a, b) (((a) & (b)) != 0)
120
121#define SH_TXT_MAX 9200
122
123#define MASK_ALLIGNORE_ 0
124extern unsigned long mask_ALLIGNORE;
125#define MASK_ATTRIBUTES_ (MODI_MOD|MODI_USR|MODI_GRP|MODI_RDEV)
126extern unsigned long mask_ATTRIBUTES;
127#define MASK_LOGFILES_ (MASK_ATTRIBUTES_|MODI_HLN|MODI_LNK|MODI_INO)
128extern unsigned long mask_LOGFILES;
129#define MASK_LOGGROW_ (MASK_LOGFILES_|MODI_SIZ|MODI_SGROW|MODI_CHK)
130extern unsigned long mask_LOGGROW;
131#define MASK_READONLY_ (MASK_LOGFILES_|MODI_CHK|MODI_SIZ|MODI_MTM|MODI_CTM)
132extern unsigned long mask_READONLY;
133#define MASK_NOIGNORE_ (MASK_LOGFILES_|MODI_CHK|MODI_SIZ|MODI_ATM|MODI_MTM)
134extern unsigned long mask_NOIGNORE;
135#define MASK_USER_ (MASK_READONLY_|MODI_ATM)
136extern unsigned long mask_USER0;
137extern unsigned long mask_USER1;
138extern unsigned long mask_USER2;
139extern unsigned long mask_USER3;
140extern unsigned long mask_USER4;
141/* like READONLY, but without MTM,CTM,SIZ,INO, and with PREL)
142 */
143#define MASK_PRELINK_ (MASK_ATTRIBUTES_|MODI_HLN|MODI_LNK|MODI_CHK|MODI_PREL)
144extern unsigned long mask_PRELINK;
145
146typedef struct file_struct {
147 unsigned long check_flags;
148 int file_reported;
149 char fullpath[PATH_MAX];
150 ShFileType type;
151 dev_t dev;
152 ino_t ino;
153 mode_t mode;
154 nlink_t hardlinks;
155#if defined(__linux__) || defined(HAVE_STAT_FLAGS)
156 unsigned long attributes;
157 char c_attributes[ATTRBUF_SIZE];
158#endif
159 char c_mode[CMODE_SIZE];
160 uid_t owner;
161 char c_owner[USER_MAX+2];
162 gid_t group;
163 char c_group[GROUP_MAX+2];
164 dev_t rdev;
165 off_t size;
166 unsigned long blksize;
167 unsigned long blocks;
168 time_t atime;
169 time_t mtime;
170 time_t ctime;
171
172 char * link_path;
173 mode_t linkmode;
174 char link_c_mode[11];
175 int linkisok;
176 char * attr_string;
177} file_type;
178
179extern int sh_unix_check_selinux;
180extern int sh_unix_check_acl;
181
182/* destroy userid cache
183 */
184void sh_userid_destroy ();
185
186/* --- run a command, securely ---
187 */
188int sh_unix_run_command (const char * str);
189
190/* Ignore SIGPIPE
191 */
192void sh_unix_ign_sigpipe();
193
194/* mlock utilities
195 */
196int sh_unix_mlock(const char * file, int line, void * addr, size_t len);
197int sh_unix_munlock(void * addr, size_t len);
198int sh_unix_count_mlock(void);
199/* public for unit tests */
200int sh_unix_pagesize(void);
201unsigned long sh_unix_lookup_page(void * in_addr, size_t len, int * num_pages);
202
203/* chroot directory
204 */
205int sh_unix_set_chroot(const char * str);
206
207/* whether to use localtime for file timesatams in logs
208 */
209int sh_unix_uselocaltime (const char * c);
210
211/* whether to perform selinux/acl checks
212 */
213#ifdef USE_XATTR
214int sh_unix_setcheckselinux (const char * c);
215#endif
216#ifdef USE_ACL
217int sh_unix_setcheckacl (const char * c);
218#endif
219#if defined(__linux__) || defined(HAVE_STAT_FLAGS)
220int sh_unix_setcheckattributes (const char * c);
221#endif
222
223/* set I/O limit
224 */
225int sh_unix_set_io_limit (const char * c);
226void sh_unix_io_pause (void);
227
228/* get file type
229 */
230int sh_unix_get_ftype(char * fullpath);
231
232/* reset masks for policies
233 */
234int sh_unix_maskreset(void);
235
236/* return true if database is remote
237 */
238int file_is_remote (void);
239
240/* return the path to the configuration/database file
241 */
242char * file_path(char what, char flag);
243
244/* return current time as unsigned long
245 */
246unsigned long sh_unix_longtime (void);
247
248/* close all files >= fd, except possibly one
249 */
250void sh_unix_closeall (int fd, int except, int inchild);
251
252/* Check whether directory for pid file exists
253 */
254int sh_unix_check_piddir (char * pidpath);
255
256/* write lock for filename
257 */
258int sh_unix_write_lock_file(char * filename);
259
260/* rm lock(s) for log file(s)
261 */
262int sh_unix_rm_lock_file(char * filename);
263
264/* write the PID file
265 */
266int sh_unix_write_pid_file(void);
267
268/* rm the PID file
269 */
270int sh_unix_rm_pid_file(void);
271
272
273/* checksum of own binary
274 */
275int sh_unix_self_hash (const char * c);
276
277/* return BAD on failure
278 */
279int sh_unix_self_check (void);
280
281/* add a trusted user to the list
282 */
283int tf_add_trusted_user(const char *);
284
285/* check a file
286 */
287int tf_trust_check (const char * file, int mode);
288
289/* initialize group vector
290 */
291#ifdef HOST_IS_OSF
292int sh_unix_initgroups ( char * in_user, gid_t in_gid);
293#else
294int sh_unix_initgroups (const char * in_user, gid_t in_gid);
295#endif
296int sh_unix_initgroups2 (uid_t in_pid, gid_t in_gid);
297
298/* set the timeserver address
299 */
300int sh_unix_settimeserver (const char * address);
301void reset_count_dev_time(void);
302
303/* lock the key
304 */
305void sh_unix_memlock(void);
306
307/* deamon mode
308 */
309int sh_unix_setdeamon (const char * dummy);
310int sh_unix_setnodeamon(const char * dummy);
311
312/* Test whether file exists
313 */
314int sh_unix_file_exists(char * path);
315
316/* test whether file exists with proper attributes
317 */
318int sh_unix_device_readable(int fd);
319
320/* local host
321 */
322void sh_unix_localhost(void);
323
324/* check whether /proc exists and is a proc filesystem
325 */
326int sh_unix_test_proc(void);
327
328/* check whether a directory is secure
329 * (no symlink in path, not world-writeable)
330 */
331/* int sh_unix_is_secure_dir (ShErrLevel level, char * tmp); */
332
333/* check whether there's a rotated log with the correct inode and checksum
334 */
335int sh_check_rotated_log (const char * path,
336 UINT64 old_size, UINT64 old_inode, const char * old_hash, unsigned long mask);
337
338/* obtain file info
339 */
340int sh_unix_getinfo (int level, const char * filename, file_type * theFile,
341 char * fileHash, int flagrel);
342
343/* read file, return length read
344 */
345int sh_unix_getline (SL_TICKET fd, char * line, int sizeofline);
346
347/* call with goDaemon == 1 to make daemon process
348 */
349int sh_unix_init(int goDaemon);
350
351/* for local time use thetime = 0, returns pointer to buffer
352 */
353char * sh_unix_time (time_t thetime, char * buffer, size_t len);
354
355/* convert to GMT time, returns pointer to buffer
356 */
357char * sh_unix_gmttime (time_t thetime, char * buffer, size_t len);
358
359/* effective user info
360 */
361int sh_unix_getUser (void);
362
363/* get home directory, , returns pointer to out
364 */
365char * sh_unix_getUIDdir (int level, uid_t uid, char * out, size_t len);
366
367/* get a group GID
368 */
369long sh_group_to_gid (const char * g, int * fail);
370
371#ifdef HAVE_GETTIMEOFDAY
372unsigned long sh_unix_notime (void);
373#endif
374
375/* check whether a directory
376 */
377int sh_unix_isdir (char * dirName, int level);
378
379#ifdef SH_STEALTH
380int sh_unix_getline_stealth (SL_TICKET fd, char * str, int len);
381void sh_unix_xor_code (char * str, int len);
382#endif
383
384#if defined(SCREW_IT_UP)
385/* for raise()
386 */
387#include <signal.h>
388#include <errno.h>
389
390void sh_sigtrap_handler (int signum);
391
392#ifdef HAVE_GETTIMEOFDAY
393#if TIME_WITH_SYS_TIME
394#include <sys/time.h>
395#include <time.h>
396#else
397#if HAVE_SYS_TIME_H
398#include <sys/time.h>
399#else
400#include <time.h>
401#endif
402#endif
403#endif
404
405struct sh_sigtrap_variables {
406 int not_traced;
407#ifdef HAVE_GETTIMEOFDAY
408 struct timeval save_tv;
409#endif
410};
411
412struct sh_sigtrap_variables * sh_sigtrap_variables_get();
413
414int sh_sigtrap_max_duration_set (const char * str);
415
416static inline
417int sh_sigtrap_prepare()
418{
419 struct sigaction act_trap;
420 int val_retry;
421 act_trap.sa_handler = &sh_sigtrap_handler; /* signal action */
422 act_trap.sa_flags = 0; /* init sa_flags */
423 sigemptyset ( &act_trap.sa_mask ); /* set an empty mask */
424 do {
425 val_retry = sigaction(SIGTRAP, &act_trap, NULL);
426 } while (val_retry < 0 && errno == EINTR);
427 return 0;
428}
429
430/*@unused@*/ static inline
431int sh_derr(void)
432{
433 struct sh_sigtrap_variables * sigtrap_variables;
434 sigtrap_variables = sh_sigtrap_variables_get();
435 if (sigtrap_variables == NULL) {
436 /* Perhaps, its better to not die, and to continue using Samhain,
437 even if this part does not work. */
438 return (0);
439 }
440
441 sigtrap_variables->not_traced = 0;
442
443#ifdef HAVE_GETTIMEOFDAY
444 gettimeofday(&sigtrap_variables->save_tv, NULL);
445#endif
446
447 /* raise() sends to same thread, like pthread_kill(pthread_self(), sig);
448 */
449 raise(SIGTRAP);
450
451 if (sigtrap_variables->not_traced == 0)
452 _exit(5);
453
454 sigtrap_variables->not_traced = 0;
455 return (0);
456}
457
458#else
459
460/*@unused@*/ static inline
461int sh_derr(void)
462{
463 return 0;
464}
465/* #if defined(SCREW_IT_UP) */
466#endif
467
468#endif
469
470
Note: See TracBrowser for help on using the repository browser.